13167 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-71478
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link...
MiracleLinux 9 : grafana-10.2.6-23.el9_8 (AXSA:2026-1487:22)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1487:22 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...
MiracleLinux 9 : plexus-utils-3.3.0-14.el9_8 (AXSA:2026-1492:01)
The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1492:01 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description bloc...
MiracleLinux 9 : grafana-pcp-5.1.1-17.el9_8 (AXSA:2026-1483:10)
The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1483:10 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...
Oracle Linux 9 : kernel (ELSA-2026-51035)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-51035 advisory. - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup Waiman Long RHEL-193526 CVE-2026-52977 - futex: Require sysfutexrequeue to have...
MiracleLinux 9 : vim-8.2.2637-26.el9_8.10.ML.1 (AXSA:2026-1480:21)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1480:21 advisory. vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162...
CVE-2026-70632
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode function fails to enforce...
EUVD-2026-54143
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...
CVE-2026-71478
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...
EUVD-2026-54261
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...
Mermaid configuration APIs allow prototype pollution
Summary Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge the caller-supplied configuration object into Mermaid's internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution. Because these APIs...
EUVD-2026-54244
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...
NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS
NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS vulnerability discovered by ? in WordPress Npm mermaid versions = 10.6.0, 10.9.8...
CVE-2026-71436 Mermaid XY Charts are vulnerable to an infinite loop DoS
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid...
Important: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...
CVE-2026-65578
Unauthenticated PHP Object Injection in Agora = 1.9 versions...
CVE-2026-65571
Unauthenticated PHP Object Injection in 69 Clothing = 1.2.11.1 versions...
CVE-2026-61964
Unauthenticated Cross Site Scripting XSS in Ninja Tables = 5.2.9 versions...